chore(security): remove drift codeql.yml, enable GitHub-managed default setup - #113
chore(security): remove drift codeql.yml, enable GitHub-managed default setup#113don-petry wants to merge 24 commits into
Conversation
…ult setup Per org CI standards §2, CodeQL must be configured through GitHub-managed default setup (Settings → Code security), not via a per-repo workflow file. Per-repo codeql.yml files are explicitly classified as drift by the compliance audit. Default setup is already configured (state=configured, query_suite=default) and was re-confirmed via API before this commit. Closes #95 Co-authored-by: don-petry <don-petry@users.noreply.github.com>
|
Warning Rate limit exceeded
Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 57 minutes and 54 seconds. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
@don-petry — this PR removes the drift |
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Removes the repository’s custom CodeQL GitHub Actions workflow to align with org CI standards that require GitHub-managed CodeQL default setup.
Changes:
- Deleted
.github/workflows/codeql.yml(previous advanced CodeQL workflow) to eliminate compliance “drift”.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
don-petry
left a comment
don-petry
left a comment
There was a problem hiding this comment.
Automated review — APPROVED
Risk: MEDIUM
Reviewed commit: 90028d661c37c2ef91b8319872d6028cba2ebacf
Cascade: triage → deep (see triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6 for models)
Summary
This PR removes a per-repo codeql.yml workflow in favor of GitHub-managed CodeQL default setup, aligning with org CI standards §2. CI checks confirm the managed setup is actively running (Analyze(python) + Analyze(actions) both passing on this PR's head). The main finding is a language coverage shift: the deleted workflow scanned javascript-typescript + actions, while the managed setup auto-detected python + actions — any JS/TS code in the repo is no longer covered by CodeQL. All quality gates (CodeQL, SonarCloud) pass and this is safe to approve.
Findings
Minor
- [minor]
.github/workflows/codeql.yml— Language coverage change: deleted workflow explicitly scanned 'javascript-typescript' and 'actions'; GitHub-managed default setup auto-detected 'python' and 'actions' only. If the repo contains JavaScript/TypeScript code, it is no longer covered by CodeQL scanning. The repo owner should verify TalkTerm has no JS/TS components or confirm managed setup detects them in the full repo scan.
Info
- [info] Issue #95 (codeql-default-setup-not-configured) will remain open post-merge because the compliance audit bot PAT lacks 'administration:read' scope and will continue receiving 403 errors. This is an audit tooling problem, not a configuration problem — CI checks confirm managed setup is active. Tracking in the PR body is acknowledged but resolution requires updating the audit bot's token in petry-projects/.github.
- [info]
.github/workflows/codeql.yml— The deleted codeql.yml used pinned action SHAs (e.g. actions/checkout@de0fac2e, codeql-action@c10b8064) and minimal scoped permissions — good practices. GitHub-managed default setup inherently avoids workflow YAML tampering vectors, so the replacement is at least as secure from a supply-chain perspective. - [info] PR authored by don-petry modifies security scanning configuration; the PR comment also tags don-petry to review. Self-review of security configuration changes is a process concern worth noting, though no malicious content is present.
Note: Approval was blocked by GitHub (cannot approve own PR). Review verdict is APPROVED — a human approver or secondary token must click Approve to unblock merge.
CI status
All CI quality gates pass: CodeQL (Analyze python + actions) and SonarCloud quality gate confirmed green on this commit.
Reviewed by the don-petry PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: gpt-5.4 → audit: opus 4.6). Reply with @don-petry if you need a human.
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: a86ac476334448494965905054ecc0b76d2eea32
Review mode: triage-approved (single reviewer)
Summary
Triage previously cleared this PR as low-risk and the prior cascade review at 90028d6 approved it with MEDIUM risk. Since then, the actual change (deletion of .github/workflows/codeql.yml) has already been merged to main via PR #117, and the linked compliance issue #95 is now CLOSED. At the current head, gh pr view reports additions: 0, deletions: 0, changedFiles: 0 — the PR is effectively a no-op, kept alive only by routine merge-from-main commits. All CI gates are green.
Linked issue analysis
Issue #95 (Compliance: codeql-default-setup-not-configured) is CLOSED. The code-side remediation (removing the drift codeql.yml) is already present on main via PR #117, and GitHub-managed CodeQL default setup is actively running (Analyze python + Analyze actions both passing). The residual compliance-audit 403 is an audit-bot PAT scope issue tracked separately in petry-projects/.github, not a code change required of this repo.
Findings
Info
- [info] This PR has zero file changes against
main(additions: 0, deletions: 0, changedFiles: 0). Its intended deletion was already shipped via PR #117. Merging this PR would be a no-op; closing it as superseded is also a reasonable outcome. No blocker either way — approving so the maintainer can choose. - [info] Branch is
MERGEABLEbutmergeStateStatus: BLOCKEDbecause the PR author cannot approve their own PR. A human approver or secondary token is required to actually unblock merge; this automated approval does not change that.
CI status
All checks green on a86ac47:
- CodeQL — Analyze (python): SUCCESS
- CodeQL — Analyze (actions): SUCCESS
- CodeQL (status context): SUCCESS
- CodeRabbit: SUCCESS
- SonarCloud quality gate: passed (0 new issues)
Reviewed automatically by the PR-review agent (single-reviewer mode: opus 4.7). Reply if you need a human review.
|
@dev-lead - please fix this PR |
|
donpetry-bot
left a comment
donpetry-bot
left a comment
There was a problem hiding this comment.
Automated review — APPROVED ✓
Risk: LOW
Reviewed commit: 80b34a909f55103e045e14b778515a13a6c7ee83
Cascade: triage → deep (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7)
Summary
This PR is a confirmed no-op at head SHA 80b34a9: additions=0, deletions=0, changedFiles=0, files=[]. The actual change (deletion of .github/workflows/codeql.yml) was already merged to main via PR #117, and linked issue #95 is CLOSED. All CI gates are green (CodeQL Analyze python+actions, SonarCloud passed). Triage's incomplete-diff signal is explained by the intervening main merge that resolved the diff before this PR was re-reviewed.
Findings
- info: PR has zero file changes against main (additions=0, deletions=0, changedFiles=0). The codeql.yml deletion originally proposed here was already shipped to main via PR #117. Merging this PR is a no-op; closing it as superseded is equally valid.
- info: Linked issue #95 (Compliance: codeql-default-setup-not-configured) is CLOSED as of 2026-04-26. The compliance finding is resolved.
- info: All CI checks green on current head: CodeQL Analyze(actions) SUCCESS, CodeQL Analyze(python) SUCCESS, CodeQL status SUCCESS, CodeRabbit SUCCESS, SonarCloud quality gate passed (0 new issues).
- minor: mergeStateStatus is BLOCKED because the PR author (don-petry) cannot approve their own PR. An existing APPROVED review from donpetry-bot is present. A human approver or separate token is required to unblock merge — this is a GitHub policy constraint, not a code quality issue.
- info: Carried-forward from prior Tier 2 review: the deleted codeql.yml scanned javascript-typescript + actions, while GitHub-managed default setup auto-detects python + actions only. If TalkTerm contains JS/TS code it is no longer covered by CodeQL. This was previously approved at MEDIUM risk in the April 25 cascade review — no new information on this point.
Reviewed by the PR-review cascade (triage: haiku 4.5 → deep: sonnet 4.6 + duck: o4-mini → audit: opus 4.7). Reply if you need a human review.
Superseded by automated re-review at 80b34a9.
|
Closing due to merge conflict that cannot be auto-rebased. Re-implementing from fresh main via dev-lead. |
Pull request was closed
Summary
state=configured,query_suite=default)codeql.ymlworkflow file, which is classified as drift by the org CI standardsWhy
Per
ci-standards.md §2, CodeQL must be configured through GitHub's default setup (Settings → Code security), not via a per-repo workflow file. The standard explicitly states: "per-repocodeql.ymlfiles are treated as drift by the compliance audit."The existing
codeql.ymlwas an advanced setup that duplicates what GitHub's managed default setup provides automatically (auto-detected languages, managed analyzer versions).Changes
.github/workflows/codeql.yml(drift per org standard)gh api -X PATCH repos/petry-projects/TalkTerm/code-scanning/default-setup -F state=configured -F query_suite=default(triggered run #24189978053)Note on compliance audit 403
The compliance audit has been consistently reporting a 403 ("Resource not accessible by personal access token") when it tries to read the code-scanning default-setup state. This is an audit-side token permissions issue — the audit bot's PAT lacks the
administration:readscope needed for the code-scanning configuration endpoint. The actual configuration isstate=configured(verifiable with a properly-scoped token). This PR removes the driftcodeql.ymlwhich is the actionable code change; the 403 in the audit will need to be resolved by updating the audit bot's token scopes inpetry-projects/.github.Closes #95
Generated with Claude Code